PT-2023-11761 · Unknown+2 · Kamailio Sip+2

Rnatella · Publicado 2023-03-15 · Atualizado 2025-02-27 · CVE-2020-27507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kamailio SIP versions prior to 5.5.0

Description The issue is related to the mishandling of INVITE requests with duplicated fields and overlength tags by the Kamailio SIP server, leading to a buffer overflow. This can cause the server to crash or potentially have other unspecified impacts.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to INVITE requests with duplicated fields and overlength tags until a patch is applied.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2020-27507

DLA-3438-1

USN-6022-1

Produtos afetados

Kamailio Sip

Linuxmint

Ubuntu

Referências · 19

• 🔥 https://github.com/kamailio/kamailio/issues/2503 · Exploit
• https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f · Correção
• https://lists.debian.org/debian-lts-announce/2023/05/msg00030.html · Nota
• https://t.me/cibsecurity/60090 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2020-27507 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-16657 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6022-1 · Aviso do Fabricante
• https://t.me/cvenotify/112682 · Publicação no Telegram
• https://ubuntu.com/security/notices/USN-6022-1 · Aviso do Fabricante
• https://t.me/cvenotify/46260 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-27507 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2020-27507 · Aviso do Fabricante
• https://t.me/cvenotify/46303 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27507 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2020-27507 · Aviso do Fabricante